Support secretless (managed identity / OIDC) Terraform provider auth in addition to SPN client secret

## Summary

Prerequisite for #173 (CD: GitHub Action to provision a sandbox).

Today the root configuration authenticates to Azure **only** via a service principal **client secret**:

- `providers.tf` hardcodes `client_id` / `client_secret` / `tenant_id` for the `azurerm`, `azapi`, and `azuread` providers.
- `variables.tf` makes `arm_client_secret` **required** (length >= 8 validation).

This blocks any secretless CD execution model (self-hosted runner using a **managed identity**, or GitHub-hosted runner using **OIDC** federated credentials).

## Goal

Refactor provider/auth configuration so the root module supports **both** of the following, selectable without breaking existing behavior:

1. **Secret-based auth (current/manual)** — `arm_client_id` + `TF_VAR_arm_client_secret`. Must continue to work unchanged for interactive/manual execution (default path).
2. **Secretless auth (CD)** — managed identity (`use_msi`) and/or OIDC (`use_oidc`) with no long-lived secret, for a self-hosted runner on the `rg-devops-iac` Terraform execution VM (managed identity) or GitHub-hosted runner (OIDC).

## Acceptance criteria

- [ ] An auth-mode toggle (e.g. variable `arm_auth_mode` = `secret` | `msi` | `oidc`, default `secret`) drives provider configuration across `azurerm`, `azapi`, and `azuread`.
- [ ] `arm_client_secret` is no longer unconditionally required — required only when auth mode is `secret`; validation relaxed/conditional accordingly.
- [ ] Existing manual flow (secret) works with no changes for current users; `bootstrap.sh`/`bootstrap.ps1` and README still valid.
- [ ] Managed-identity mode validated on the `rg-devops-iac` execution VM.
- [ ] `terraform validate` / `tflint` pass; README + module docs updated to describe the auth modes.

## Notes

- `azapi` and `azuread` providers must be handled too (not just `azurerm`); each supports `use_msi` / `use_oidc`.
- Consider that under MSI/OIDC there is no `client_secret`; any logic that derives values from it must be guarded.

Start with providers.tf and variables.tf to trace the current client-secret configuration across azurerm, azapi, and azuread. Review bootstrap.sh, bootstrap.ps1, and the README for compatibility requirements, then run terraform validate and tflint. Done means secret, MSI, and OIDC modes are documented, manual flow remains valid, and MSI is validated on the rg-devops-iac execution VM.

Written by the indexing model from the issue text.